Windows Recall stores everything you do on a plain text database? Let's see how hard is that to hack

Following user uncertainty regarding the Windows Recall feature, Microsoft calmed everybody, stating that the data collected by Windows Recall is only available locally on your PC. However, what we didn’t know, and just found out from Kevin Beumont on X, that data is far from being safe.

How does Windows Recall stores your data?

Allegedly, the date is stored on a flimsy plain text database that can be grabbed with an automated tool as simple as picking apples from a tree.

The caption posted by Beaumont, we can see that he was able to access all PC actions and app usage with some detail on the side, to make everything even more spicy. The coder explains this simple hack in a later post:

It’s just an SQLite database, feature ships in a few weeks – I’ve already modded it into an Infostealer hosted on Microsoft’s Github (a few lines of code).

And this is not all! He states that even the WhatsApp, Signal and Teams messages are recorded by Windows Recall:

I’ve tested this with messaging apps like WhatsApp, Signal and Teams. Somebody message you with disappearing messages? They’re recorded anyway. Write a disappearing message? It’s recorded. Delete a message? It’s recorded.

Beaumont also described the whole process on a Mastodon thread, where Albacore confirmed this hack.

Long story short, someone would still hack into your machine or your network and if your PC has shared resources, all your history with actions and messages are up for grabs. So, no additional security protection? No kind of encryption? Well, until Microsoft makes things a lot more clear in this department, here’s our guide on how to disable Windows 11 Recall.

Will you keep the Windows Recall feature enabled? Write your thoughts in the comments section below.